Alternative communication method

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Reasonableness and entity type matter

Under 45 CFR 164.522, covered health care providers and health plans have related but distinct rules. Record entity role, requested method, written request if required, contact details, endangerment statement when applicable to a health plan, payment handling when appropriate, and decision.

For a provider, evaluate whether the requested method is reasonable without requiring an explanation as a condition. For a health plan, capture the clear statement that disclosure could endanger the individual. Ask only for information needed to implement the method, including a usable destination and appropriate payment handling.

Authenticate safely and avoid confirming the request through the route identified as unsafe. Record scope, communication types, effective date, exceptions, and how the person wants failed delivery handled.

Change both delivery and suppression

Adding a new phone number is incomplete if old messages, reminders, statements, vendor exports, or portal notifications still use the former method. Map every communication source and suppress unsafe routes. Confirm how the individual wants exceptions and failed deliveries handled.

Inventory scheduling, clinical messages, billing, statements, reminders, surveys, collections, record delivery, portal alerts, payers, and vendors. Separate contact data used for confidential communications from residential, service, or billing data that may remain valid for other purposes.

Test the safe route end to end

Send controlled messages from every source and confirm content, destination, sender identity, and suppression of old channels. Test voicemail, email previews, shared portal accounts, failed messages, and fallback logic. A system that silently falls back to the unsafe route needs a hold or exception queue.

Version changes and terminations. Preserve the prior method, request, decision, effective date, implementation evidence, and completed downstream updates. Restrict workforce visibility so the request itself does not create risk.

Example across communication systems

A request affects eight systems. Seven use the approved method and suppress the old one; a survey vendor still texts the prior number. Implementation is 7 of 8 systems. The request remains operationally incomplete.

Pause the vendor route, correct the destination, and assess any text already sent. Completion becomes 8 of 8 only after a verified test. Request approval and system implementation are separate milestones.

Method checklist

• Classify provider or health-plan rules and capture required facts.
• Verify identity through a safe channel and document exact scope.
• Map every internal, payer, vendor, and manual sender.
• Configure the new method and suppress unsafe fallback.
• Test delivery, previews, failure handling, and shared access.
• Version changes and retain decision and implementation evidence.
• Review misroutes under incident procedures.

Owner controls

The HHS Audit Protocol reviews confidential-communication procedures. Use safe confirmation, role-limited display, method validation, vendor propagation, failure handling, periodic tests, and a change or termination path. Avoid revealing the request through unsafe contact.

Monitor requests, approvals, implementation lag, sender coverage, failures, and misroutes. Retest after vendor, portal, billing, or messaging changes and during continuity exercises.

Create an intake record that separates the individual's safe method from ordinary profile contacts. Include scope, entity type, any permitted writing requirement, health-plan endangerment statement when applicable, limited payment information, effective date, failed-delivery preference, and owner. Preserve the original request and decision. If a method is unreasonable or technically unavailable, route the conclusion for qualified review and discuss a usable alternative through a safe channel.

Audit actual communications, not just configuration screens. Sample appointments, clinical messages, billing, portal alerts, surveys, releases, and vendor output for active requests. Trace misroutes to source logic and assess affected communications. Test device previews and shared accounts because content can be exposed before a message opens. During downtime, give staff a controlled manual route and prevent backlog from later replaying to the former method.

Review reasonableness decisions for consistent criteria and individualized facts. Record alternatives discussed and avoid defaulting every request to one channel because it is convenient for the entity. When technology changes, contact the individual through the current safe method before moving them to a replacement. Test identity verification, opt-out, contact changes, and termination without exposing the protected request. Train all sender owners, not just privacy staff, and make the safe method visible at the point of communication. Investigate messages generated outside the normal system, including staff phones and ad hoc vendor campaigns.

Keep an active sender inventory with owner, method source, last test, failure rule, and vendor dependency. Reconcile it to real outbound logs periodically. A sender with no recent messages still needs testing because the next communication may be sensitive. Preserve change and approval history through account merges.